CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, but then drops $entry-metakey straight into the SQL string without escaping: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Because metakey comes from the database, the code treats it as trusted. But...

CVE-2019-9053

CVE-2019-9053 CMS Made Simple For educational purposes and authorized security testing only...

CVE-2025-25257

CVE-2025-25257 - FortiWeb Vulnerability Checker & Exploit A Python-based tool for checking and exploiting CVE-2025-25257 vulnerability in FortiWeb devices. This vulnerability allows SQL injection and remote code execution through a crafted Authorization header. 📋 Description CVE-2025-25257 is a...

CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...

atutor-blind-sqli

ATutor v2.2.1 Blind SQL Injection Exploiting CVE-2016-2555 enumerating and dumping the underlying Database. Disclaimer All the information provided in this post is for educational purposes only. You shall not misuse the information to gain unauthorized access and/or write malicious programs. The...

wp2shell

wp2shell - WordPress RCE PoC CVE-2026-63030 + CVE-2026-60137 Unauthenticated Remote Code Execution in WordPress Core by: JohenLastGen 📌 Overview This tool chains two critical WordPress vulnerabilities to achieve unauthenticated RCE : Vulnerability| CVE| Description ---|---|--- REST Batch Route...

CVE-2021-39165

CVE-2021-39165 Python3 POC for CVE-2021-39165 in CachetHQ Usage First of all, you should install the dependencies: pip3 install -r requirements.txt If you want to check whether the victim URL is vulnerable or not, you can execute: python3 exploit.py -u -c If you want to know the output of a MySQL...

CVE-2026-101878

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2025-22953

CVE-2025-22953 – Epicor HCM Unauthenticated Blind SQL Injection Update – Patch Released by Epicor Epicor has officially released a patch addressing this vulnerability. All affected users are strongly advised to apply the update immediately. 🔗 Epicor Security Patch Announcement Summary An...

CVE-2026-101878

Bitwarden Server versions 2025.6.0 before 2026.5.0 are vulnerable to an authentication bypass on SQL Server deployments. The root cause is an identifier truncation issue where the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure is declared as NVARCHAR(50),...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

EUVD-2026-88605

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

litellm-sqli-scanner

LiteLLM SQL Injection Scanner CVE-2026-42208 — SQL injection in LiteLLM Proxy Detects and validates CVE-2026-42208: SQL injection vulnerability in LiteLLM Proxy's database layer. For authorized security testing only. Features CVE-2026-42208 SQL injection detection LiteLLM Proxy version...

CVE-2025-4840

CVE-2025-4840 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

CVE-2018-8045

CVE-2018-8045 Joomla core SQL injection vulnerability principle and poc...

CVE-2026-63030

Wordpress Core / SQLi 6.9.0 - 6.9.4 7.0.0 - 7.0.1 PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE_POC_test

CVEPOCtest Reproduction and POC test code for CVE-2019-13086 vulnerability Original CVE information: https://vulners.com/cve/CVE-2019-13086 Test environment: CSZ CMS architecture + php5.4 + MySQL 5.5 + Apache 2.4 Vulnerability types: SQL injection vulnerability File upload vulnerability Brief...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL Injection PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Overview CVE-2026-26980 is an unauthenticated SQL Injection vulnerability in TryGhost Ghost CMS Content API. The vulnerable path is...

CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – GraphQL Batching Alias Confusion SQL Injection Overview A GraphQL resolver constructs SQL queries dynamically from field aliases. By using batching and aliases, an attacker bypasses an allow‑list and injects SQL. Severity: Critical Database Takeover Node.js Server & Exploit //...